KUBO Privacy Policy

Last updated November 13, 2024

This privacy notice for KUBO Education ApS (doing business as KUBO) (“we,” “us,” or “our”), describes how and why we might collect, store, use, and/or share (“process”) your information when you use our services (“Services”), such as when you:

• Visit our website at https://eu-portal.kubo.education, or any website of ours that links to this privacy notice
• Download and use our mobile application (MyKUBO-App and KUBO Play), or any other application of ours that links to this privacy notice
• Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at daniel@kubo-robot.com.

SUMMARY OF KEY POINTS

This summary provides key points from our privacy notice, but you can find out more details about any of these topics by clicking the link following each key point or by using our table of contents below to find the section you are looking for.

• What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
• Do we process any sensitive personal information? We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law. Learn more about sensitive information we process.
• Do we receive any information from third parties? We may receive information from public databases, marketing partners, social media platforms, and other outside sources. Learn more about information collected from other sources.
• How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more.
• In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties. Learn more.
• How do we keep your information safe? We have organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. Learn more.
• What are your rights? Depending on where you are located, you may have certain rights regarding your personal information. Learn more.
• How do you exercise your rights? The easiest way is by emailing daniel@kubo-robot.com or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.

Want to learn more about what we do with any information we collect? Review the privacy notice in full.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
6. HOW LONG DO WE KEEP YOUR INFORMATION?
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
8. DO WE COLLECT INFORMATION FROM MINORS?
9. WHAT ARE YOUR PRIVACY RIGHTS?
10. CONTROLS FOR DO-NOT-TRACK FEATURES
11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
12. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?
13. WHEN YOU ARE USING OUR KUBO PLAY AS A STUDENT
14. DO WE MAKE UPDATES TO THIS NOTICE?
15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• names
• phone numbers
• email addresses
• usernames
• passwords
• contact or authentication data
• billing addresses
• debit/credit card numbers
• name of classrooms
• nicknames of students
• job titles
• name of educational institution

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• student data

Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number, and the security code associated with your payment instrument. All payment data is stored by Stripe. You may find their privacy notice here: https://stripe.com/en-gb-dk/privacy.

As a user you can purchase and pay via your local distribution partner.

Application Data

If you use our application(s), we also may collect the following information if you choose to provide us with access or permission:

Mobile Device Data. We automatically collect device information (such as your mobile device ID, model, and manufacturer), operating system, version information and system configuration information, device and application identification numbers, browser type and version, hardware model Internet service provider and/or mobile carrier, and Internet Protocol (IP) address (or proxy server). If you are using our application(s), we may also collect information about the phone network associated with your mobile device, your mobile device’s operating system or platform, the type of mobile device you use, your mobile device’s unique device ID, and information about the features of our application(s) you accessed.

This information is primarily needed to maintain the security and operation of our application(s), for troubleshooting, and for our internal analytics and reporting purposes.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

• Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as date/time stamps, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called “crash dumps”), and hardware settings).
• Device Data. Information about your computer, phone, tablet, or other device you use to access the Services (e.g., IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information).
• Location Data. Information about your device’s location, which can be either precise or imprecise (e.g., GPS and other technologies to collect geolocation data based on your IP address). You can opt out by refusing access or disabling Location settings, but some features may not function.

Information collected from other sources

In Short: We may collect limited data from public databases, marketing partners, and other outside sources.

To enhance our ability to provide relevant marketing, offers, and services and update our records, we may obtain information about you from other sources, such as public databases, joint marketing partners, affiliate programs, data providers, and other third parties. This information includes mailing addresses, job titles, email addresses, phone numbers, intent data (or user behavior data), IP addresses, social media profiles and URLs, and custom profiles, for purposes of targeted advertising and event promotion.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver and facilitate delivery of services to the user.
• To respond to user inquiries/offer support to users.
• To send administrative information to you (e.g., product/service details, changes to terms and policies).
• To fulfill and manage your orders, payments, returns, and exchanges made through the Services.
• To request feedback and contact you about your use of our Services.
• To send you marketing and promotional communications (in accordance with your preferences; you can opt out at any time).
• To deliver targeted advertising.
• To protect our Services (including fraud monitoring and prevention).
• To identify usage trends and improve our Services.
• To determine the effectiveness of marketing and promotional campaigns.
• To save or protect an individual’s vital interest.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason under applicable law (e.g., consent, contract, legal obligations, vital interests, or legitimate interests).

If you are located in the EU or UK, the GDPR/UK GDPR require us to explain the valid legal bases we rely on:

• Consent. You can withdraw your consent at any time.
• Performance of a Contract. To fulfill our contractual obligations to you or at your request before entering into a contract.
• Legitimate Interests. When reasonably necessary and not overridden by your rights (e.g., offers and discounts, personalized ads, analytics and improvement, marketing support, diagnosing problems/preventing fraud, understanding product usage to improve UX).
• Legal Obligations. For compliance, cooperation with law enforcement/regulators, exercising/defending legal rights, or litigation.
• Vital Interests. To protect your vital interests or those of a third party.

In legal terms, we are generally the “data controller” under European data protection laws of the personal information described in this privacy notice. This notice does not apply to personal information we process as a “data processor” on behalf of our customers (data controllers). For those situations, consult the customer’s privacy policy.

If you are located in Canada, we may process your information with your express or implied consent. In limited cases, we may process without consent where permitted by law (e.g., investigations, fraud prevention, business transactions with conditions, subpoenas/court orders, journalistic/artistic/literary purposes, publicly available information, etc.).

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations and/or with the following categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third parties who perform services for us or on our behalf and require access to such information. Contracts restrict their use and sharing and require protection and retention only as instructed.

Categories of third parties may include:

• Payment Processors
• Order Fulfillment Service Providers
• Sales & Marketing Tools
• Data Storage Service Providers
• Distribution Partners

Other sharing situations:

• Business Transfers. In connection with or during negotiations of any merger, sale of assets, financing, or acquisition.
• Affiliates. We may share with affiliates who will honor this privacy notice.
• Business Partners. To offer certain products, services, or promotions.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels). Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this privacy notice unless otherwise required by law.

We only keep personal information as long as necessary for the purposes set out in this notice (or longer as required/permitted by law, e.g., tax, accounting). No purpose requires keeping your personal information longer than the period of time in which users have an account with us.

When there is no ongoing legitimate business need, we will delete or anonymize your information, or securely store it and isolate it from further processing until deletion is possible (e.g., backups).

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through organizational and technical security measures.

We implement appropriate and reasonable technical and organizational security measures. However, no electronic transmission or storage technology is 100% secure. Transmission of personal information to and from our Services is at your own risk. Use a secure environment.

8. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to minors.

We do not knowingly solicit data from or market to children under 18 years of age. By using the Services, you represent that you are at least 18 or that you are the parent/guardian and consent to the minor’s use. If we learn personal information from users under 18 was collected, we will deactivate the account and promptly delete such data. Contact us at daniel@kubo-robot.com if you become aware of any such data.

Our services are intended for users above 18 years old. However, adults (teachers/parents) may establish student profiles exclusively for educational purposes, acting as administrators to oversee and manage student accounts in a secure, privacy-conscious environment.

By creating a student profile for a user under 18 years old you confirm you have parental/guardian consent.

When educators create student profiles, we do not require personally identifiable information such as full names, email addresses, or phone numbers. Instead, we encourage unique, non-identifying nicknames/pseudonyms used solely within the educational context.

The data we collect about students:

• Nicknames or pseudonyms
• Number of students in a class
• Progress with educational tasks
• Name of the educational institution
• Name of the teacher

We do not sell or share students’ data. The above data is necessary for our Services to function. We do not use students’ data for marketing nor disclose it to distribution partners.

For questions, concerns, or deletion requests related to students under 18, contact: daniel@kubo-robot.com.

9. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: In some regions (EEA, UK, Switzerland, Canada), you have rights to access and control your personal information. You may review, change, or terminate your account at any time.

Depending on your location, you may have rights to:

• request access and obtain a copy of your personal information,
• request rectification or erasure,
• restrict processing,
• data portability (if applicable),
• not be subject to automated decision-making, and
• object to processing in certain circumstances.

We will consider and act upon any request in accordance with applicable laws.

• EEA/UK: You may complain to your Member State or UK data protection authority.
• Switzerland: You may contact the Federal Data Protection and Information Commissioner.

Withdrawing consent: Where we rely on consent, you may withdraw it at any time by contacting us (see How can you contact us). This does not affect processing before withdrawal or processing based on other lawful grounds.

Opting out of marketing: Unsubscribe via the link in our emails or contact us. We may still send service-related messages.

Account Information

If you would like to review/change information in your account or terminate your account, you can:

• Contact us using the contact information provided.

Upon termination, we will deactivate or delete your account and info from active databases, but may retain some information to prevent fraud, troubleshoot, assist investigations, enforce legal terms, or comply with legal requirements.

Cookies and similar technologies: Most browsers accept cookies by default. You can remove/reject cookies, which may affect certain features or services.

Questions or comments about your privacy rights? Email daniel@kubo-robot.com.

10. CONTROLS FOR DO-NOT-TRACK FEATURES

Most browsers and some mobile OS/apps include a Do-Not-Track (DNT) setting. No uniform standard has been finalized; therefore, we do not currently respond to DNT signals. If a standard is adopted that we must follow, we will inform you in a revised notice.

11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: If you are a resident of California, Colorado, Connecticut, Virginia or Utah, you are granted specific rights regarding access to your personal information.

What categories of personal information do we collect?

We have collected the following categories of personal information in the past twelve (12) months:

Retention: We use/retain collected personal information as needed to provide the Services or for:

• Category A — As long as the user has an account with us
• Category B — As long as the user has an account with us
• Category F — As long as the user has an account with us
• Category G — As long as the user has an account with us
• Category H — Text or video testimonials can be shared only with consent. Removal requests: yourfriends@kubo-robot.com
• Category I — As long as the user has an account with us
• Category J — As long as the user has an account with us
• Category K — As long as the user has an account with us
• Category L — As long as the user has an account with us

Category L information may be used, or disclosed to a service provider/contractor, for additional specified purposes. You have the right to limit the use or disclosure of your sensitive personal information.

We may also collect other personal information outside of these categories through interactions (support, surveys/contests, service delivery, inquiries).

How do we use and share your personal information? See How do we process your information?

We collect/share your personal information through:

• Targeting cookies / Marketing cookies

Will your information be shared with anyone else? We may disclose personal information with service providers under contract. See When and with whom we share.

We may use personal information for our own business purposes (e.g., internal research/technological development). This is not considered “selling.”

We have not sold or shared personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following category of personal information for a business or commercial purpose in the preceding twelve (12) months:

• Category H. Audio, electronic, visual, and similar information

The categories of third parties to whom we disclosed personal information can be found under When and with whom we share.

California Residents

Shine The Light (Civ. Code § 1798.83): California residents may request, once per year and free of charge, information about categories of personal information (if any) disclosed to third parties for direct marketing and the names/addresses of such third parties. Submit requests in writing (see contact details below).

Under 18: If you are under 18, reside in California, and have a registered account, you may request removal of publicly posted data. Include the email associated with your account and a statement that you reside in California. We will ensure the data is not publicly displayed; complete removal from all systems (e.g., backups) may not be possible.

CCPA Privacy Notice: California “residents” have the following rights:

• Right to delete personal information (subject to legal exceptions).
• Right to know (categories, purposes, sales/sharing, recipients, specific pieces).
• Right to non-discrimination for exercising rights.
• Right to limit use/disclosure of sensitive personal information to what’s necessary to perform the Services.
• Opt-out of future selling/sharing of personal information to third parties. We act as soon as feasible, no later than 15 days.

To exercise: email daniel@kubo-robot.com or visit: daniel@kubo-robot.com. You can also email yourfriends@kubo-robot.com.

Verification process: We may request information to verify your identity/authority. We only use verification info for that purpose and delete it after verification.

Other privacy rights: Object to processing; request correction or restriction; designate an authorized agent (with proof). Opt-out of future selling/sharing.

Colorado Residents

Under the Colorado Privacy Act (CPA), rights include: inform, access, correct, delete, obtain a copy, and opt out (targeted advertising, sale, profiling with legal/similar effects).
Submit requests via daniel@kubo-robot.com or daniel@kubo-robot.com.

Appeals: Email daniel@kubo-robot.com. We will respond within 45 days (extendable once by 45 days with notice).

Connecticut Residents

Under the Connecticut Data Privacy Act (CTDPA), rights include: inform, access, correct, delete, obtain a copy, and opt out (targeted ads, sale, profiling with legal/similar effects).
Submit requests via daniel@kubo-robot.com.

Appeals: Email daniel@kubo-robot.com. We will respond within 60 days.

Utah Residents

Under the Utah Consumer Privacy Act (UCPA), rights include: inform, access, delete, obtain a copy, and opt out (targeted advertising or sale).
Submit requests via daniel@kubo-robot.com.

Virginia Residents

Under the Virginia Consumer Data Protection Act (VCDPA):

• “Consumer” means a Virginia resident acting in an individual/household context.
• “Personal data” excludes de-identified or publicly available information.
• “Sale” means exchange for monetary consideration.

Rights: inform, access, correct, delete, obtain a copy, and opt out (targeted ads, sale, profiling with legal/similar effects).

Exercise: Email daniel@kubo-robot.com. Authorized agents must provide proof.

Verification: We may request reasonable additional information. Responses within 45 days; extendable by 45 days with notice.

Right to appeal: Email daniel@kubo-robot.com. We will respond within 60 days. If denied, you may contact the Attorney General.

12. DO OTHER REGIONS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: You may have additional rights based on the country you reside in.

Australia

We collect/process personal information under the Privacy Act 1988. This notice satisfies notice requirements (what we collect, sources, purposes, recipients).

If you do not provide necessary personal information, it may affect our ability to provide services (offer products/services, respond/help, manage your account, confirm identity, protect your account).

You may request access/correction at any time (see How can you review, update, or delete).

If you believe we are unlawfully processing your personal information, you may submit a complaint to the Office of the Australian Information Commissioner.

13. WHEN YOU ARE USING KUBO PLAY (BOTH, WEB VERSION AND KUBO PLAY APPLICATION) AS A STUDENT

Types of personal data and their purpose:

• Log-In-Data to the platform. Maintaining a user profile
• Student Nickname (Optional). To allow the educator to identify students
• Relation to educational institution & educator. To group students in classes and give educators access to students’ progress
• Usage of KUBO Play
  • Progress Tracking: levels completed, assignments
  • Homework and Assignments: completion status
  • Usage of Tiles (Programming Language): types used, code complexity
  • Engagement Metrics: time spent, levels attempted, other metrics
  • Learning Analytics: insights for teachers/students/parents

This information enhances the educational experience, provides personalized learning, and supports teachers in managing classroom activities. Data is handled under applicable legal frameworks.

Cookies (per Danish “Cookiebekendtgørelse,” Bekendtgørelse nr. 1148 af 09.12.2011).

Legal basis for processing:

• Regulation (EU) 2016/679, Article 6(1)(b)
• Regulation (EU) 2016/679, Article 6(1)(a)

Origins of personal data:

• Cookies and usage data collected during platform usage
• Contact information and other personal data collected during profile creation/changes and provided by the teacher

User Rights: Under GDPR and other privacy laws, users may access, rectify, delete, or object to processing. Contact: yourfriends@kubo-robot.com.

Privacy Practices for Minors: We comply with COPPA and GDPR provisions for children, obtain verifiable parental consent, and allow parents/guardians to review/delete/prohibit further collection by contacting yourfriends@kubo-robot.com.

Data from Third-Party OAuth Providers: We receive data necessary for login/authentication from OAuth providers (who collect consent directly). We do not share your personal data with third parties. We handle such data per this Policy and applicable laws, including GDPR.

No Sharing of Data with Third Parties: We do not share personal data with third-party companies, advertisers, or external services, except as required by law or necessary for technical operation under strict data protection terms.

Storage of personal data: When an educator deletes a student profile, connected personal data will be deleted. Annually on May 25 (or next workday), we review stored personal data and erase data no longer necessary.

Security Measures: We use physical, electronic, and administrative safeguards. While no system is impenetrable, we strive to protect your data to a high standard.

Contact: For questions or to exercise GDPR rights, contact yourfriends@kubo-robot.com.

14. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this notice from time to time. The updated version will be indicated by a revised date and will be effective as soon as accessible. For material changes, we may post a prominent notice or send you a notification. Please review this notice frequently.

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments, contact our Data Protection Officer (DPO):

• Daniel Lindegaard
  Email: daniel@kubo-robot.com
  Phone: +45 93 942 511
  Post:
  KUBO Education ApS
  Daniel Lindegaard
  Ved Hegnet 17
  Odense 2960
  Denmark

If you are a resident in the EEA or Switzerland, we are the data controller of your personal information. We have appointed KUBO Education ApS to be our representative in the EEA and Switzerland. You can contact them regarding our processing:

• Email: daniel@kubo-robot.com
• Website: https://kubo-robot.com
• Phone: +45 93942511
• Post:
  Ved Hegnet 17
  Rungsted Kyst, South Denmark 2960
  Denmark

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, change that information, or delete it.
To request to review, update, or delete your personal information, please contact: daniel@kubo-robot.com.